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DETAILED ACTION 

1 . A response was received on 1 9 January 2006. By this response, Claims 1 , 5-9, 
12, and 15-17 have been amended. No claims have been added or canceled. Claims 
1-17 are currently pending in the present application. 

Response to Arguments 

2. Applicant's arguments filed 19 January 2006 have been fully considered but they 
are not persuasive. 

Regarding the rejection of Claims 9-17 under 35 U.S.C. 101 as non-statutory, 
Applicant argues that the claims have been amended and "are directed to statutory 
subject" (page 8 of the present response). The Examiner respectfully disagrees. With 
respect to Claims 9-14, the claims still recite the broad limitation "machine-accessible 
medium", which is broad enough to encompass non-statutory embodiments. When a 
claim can include non-statutory embodiments, the claim as a whole is considered to be 
non-statutory. With respect to Claims 15-17, although Claim 15 has been amended to 
recite a method generating a digital signal instead of only claiming the signal itself, the 
claimed method does not produce a useful, concrete, and tangible result as required 
(see below). 

Regarding the rejection of Claims 8 and 12 under 35 U.S.C. 112, second 
paragraph, the Examiner notes that the issues of indefiniteness noted in the previous 
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Office action have not been entirely addressed by the amendments. Specifically in 
reference to Claim 8, the Examiner notes that by the common definition of revoking a 
certificate, only the issuer of the certificate has the ability to revoke the certificate. 
However, Claim 8 recites the client revoking the at least one first certificate, when the 
client is not the issuer; rather, the authorizer is the issuer. Specifically in reference to 
Claim 12, the claim remains unclear as to the interpretation of "granting access to the 
third party". See below regarding the rejections under 35 U.S.C. 1 12 for further detail. 

Claims 1-9 and 12-16 were rejected under 35 U.S.C. 102(e) as anticipated by 
McGarvey, US Patent 6643774. Claim 10 was rejected under 35 U.S.C. 103(a) as 
unpatentable over McGarvey in view of Eastlake et al, "XML-Signature Syntax and 
Processing", and Claims 11 and 17 were rejected under 35 U.S.C. 103(a) as 
unpatentable over McGarvey in view of Ellison et al, "SPKI Certificate Theory". 
Specifically in reference to Claim 1 , and also to Claims 9 and 1 5, Applicant first argues 
that McGarvey does not disclose a second certificate that identifies the third party. The 
Examiner notes that there does not appear to be written description of such a limitation 
in the specification, as detailed below. Further, the Examiner believes that McGarvey 
does, in fact, disclose a certificate identifying the third party (see column 11, lines 51-55; 
column 10, lines 61-67; and column 9, lines 15-26, noting the server certificate, where 
the server corresponds to the claimed third party). Applicant further argues that the 
claimed invention "removes the need of the third party and the client to renew 
authorization after a period of time because the authorization is verifies [sic] with every 
transaction" and that McGarvey discloses systems that operate in a contrary manner 
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(page 9 of the present response). However, the Examiner believes that the description 
at the cited portion of McGarvey (column 12, lines 32-36) describing renewing tickets is 
not contrary to Applicant's invention, noting that Applicant's own specification discloses 
short term or one-time use certificates, which force the third party to get new 
authorization "after a short time" giving the client more control over the delegation of 
authorization (see paragraph 0025 of the present specification). 

Further, regarding Claim 3, Applicant argues that McGarvey does not disclose a 
one-time use certificate; however, the Examiner believes that McGarvey does disclose 
a one-time use certificate (see column 8, lines 8-13, where a certificate can be for a 
specific unit of work). Regarding Claim 5, Applicant argues that McGarvey does not 
disclose limiting the third party's use. of the first certificate; however, the cited portion of 
McGarvey clearly states that the authorization and trust given to the third party 
(implicitly by the certificates) is limited (column 8, lines 8-13). 

Therefore, for the reasons detailed above, the Examiner maintains the rejections 
as set forth below. 

Drawings 



3. The objection to the drawings is withdrawn in light of the amended drawings. 
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Specification 

4. Although Applicant has corrected the specific errors noted in the previous Office 
action, it appears that the specification still contains errors. Therefore, the objection to 
the specification is not withdrawn. 

5. The disclosure is objected to because of the following informalities: 

The specification appears to contain minor typographical and other errors. For 
example, in paragraph 0019, at the top of page 8, it appears that "SKPI" is intended to 
read "SPKI"; in paragraph 0027, at the bottom of page 10, it appears that in the phrase 
"the authorizer access the URI 810", "access" is intended to read "accesses"; and in 
paragraph 0030, on page 12, it appears that in the phrase "the above description it is 
intended to be illustrative", the word "it" should be deleted. 

Appropriate correction is required. The above is not intended as an exhaustive 
list of errors. Applicant's cooperation is requested in correcting any other errors of 
which applicant may become aware in the specification. 

6. The specification is objected to as failing to provide proper antecedent basis for 
the claimed subject matter. See 37 CFR 1.75(d)(1) and MPEP § 608.01 (o). Correction 
of the following is required: The specification does not provide proper antecedent basis 
for the limitation in amended Claim 1 , "wherein the at least one second certificate 
identifies the third party". See below regarding the rejection under 35 U.S.C. 112, first 
paragraph. 
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Claim Rejections • 35 USC § 101 

7. 35 U.S.C. 101 reads as follows: 

Whoever invents or discovers any new and useful process, machine, manufacture, or composition of 
matter, or any new and useful improvement thereof, may obtain a patent therefor, subject to the 
conditions and requirements of this title. 

8. Claims 9-17 are rejected under 35 U.S.C. 101 because the claimed invention is 
directed to non-statutory subject matter. 

Claims 9-14 are directed to a "machine-accessible medium" including a computer 
program ("instructions") for performing method steps. The term "machine-accessible 
medium" is broad enough to encompass, for example, a computer program written on 
paper. This is a computer program or data structure per se. Functional descriptive 
material such as a computer program perse that is not embodied in a computer 
readable medium is not statutory subject matter. See MPEP § 2106 IV.B.1 (a). 

Claims 15-17 are directed to methods, comprising a single step of generating a 
signal. Although a method clearly falls into one of the statutory classes of invention 
(process), the method does not produce a useful, concrete, and tangible result. The 
generation of a digital signal in and of itself is not a tangible result; further, it does not 
appear that there is a clear use for the signal by itself without providing for some 
function, for example, within a computer. See MPEP § 2106 IV.B.2. 
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Claim Rejections - 35 USC §112 

9. The following is a quotation of the first paragraph of 35 U.S.C. 112: 

The specification shall contain a written description of the invention, and of the manner and process of 
making and using it, in such full, clear, concise, and exact terms as to enable any person skilled in the 
art to which it pertains, or with which it is most nearly connected, to make and use the same and shall 
set forth the best mode contemplated by the inventor of carrying out his invention. 

1 0. Claims 1 -8 are rejected under 35 U.S.C. 1 12, first paragraph, as failing to comply 
with the written description requirement. The claims contain subject matter which was 
not described in the specification in such a way as to reasonably convey to one skilled 
in the relevant art that the inventors, at the time the application was filed, had 
possession of the claimed invention. Specifically, Claim 1 has been amended to recite 
the limitation "wherein the at least one second certificate identifies the third party". 
There does not appear to be any written description of this limitation in the specification, 
nor does there appear to be any mention of the second certificate identifying any device 
or party. Further, the specification explicitly states that authorization certificates are 
capable of delegating limited privileges to a third party without revealing the identity of 
the third party (see paragraph 0012 of the present specification); this appears to 
explicitly contradict the newly added claim limitation. Claims 2-8 are rejected due to 
their dependence on a rejected base claim. 

11. The rejections of Claims 1-7, 9-11, 13, 14, and 16 under 35 U.S.C. 112, second 
paragraph, as indefinite are withdrawn in light of the amendments to the claims. As 
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noted above, the rejections of Claims 8 and 12 are maintained for the reasons detailed 
below. 

12. The following is a quotation of the second paragraph of 35 U.S.C. 112: 

The specification shall conclude with one or more claims particularly pointing out and distinctly 
claiming the subject matter which the applicant regards as his invention. 

13. Claims 8 and 12 are rejected under 35 U.S.C. 112, second paragraph, as being 
indefinite for failing to particularly point out and distinctly claim the subject matter which 
applicant regards as the invention. 

Claim 8 recites the limitation "the client not providing the at least one first 
certificate". There is insufficient antecedent basis for this limitation in the claim; further, 
the limitation is generally vague. Additionally, the claim recites "revoking, by the client, 
the at least one first certificate"; however, by the art-accepted definition of the term, a 
certificate can only be revoked by the issuer, and the client is not the issuer of the first 
certificate(s). Rather, the authorizer is the issuer, and therefore, the client would not be 
able to revoke the first certificate(s). This contradiction further renders the claim 
indefinite. 

Claim 12 recites the limitation "granting access to the third party". It is unclear 
whether "granting access to the third party" is to be read as the third party is allowed to 
access another party such as the authorizer, or as another party being allowed to 
access the third party. That is, it is not clear if it is the third party that is given access to 
another party, or another party is given access to the third party. This renders the claim 
indefinite. For purposes of interpreting the prior art, the former interpretation is 
assumed. 
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Claim Rejections - 35 USC § 102 

14. The following is a quotation of the appropriate paragraphs of 35 U.S.C. 102 that 
form the basis for the rejections under this section made in this Office action: 

A person shall be entitled to a patent unless - 

(e) the invention was described in (1) an application for patent, published under section 122(b), by 
another filed in the United States before the invention by the applicant for patent or (2) a patent 
granted on an application for patent by another filed in the United States before the invention by the 
applicant for patent, except that an international application filed under the treaty defined in section 
351(a) shall have the effects for purposes of this subsection of an application filed in the United States 
only if the international application designated the United States and was published under Article 21(2) 
of such treaty in the English language. 

15. Claims 1-9 and 12-16 are rejected under 35 U.S.C. 102(e) as being anticipated 
by McGarvey, US Patent 6643774. 

In reference to Claim 1 , McGarvey discloses a method including a client storing a 
first certificate from an authorizer, the client storing a URI associated with the first 
certificate and a third party, the client providing a certificate and the URI to the third 
party (see column 12, lines 22-26), and the client providing the first certificate to the 
authorizer upon the authorizer accessing the URI, in which the client retains control over 
the third party's use of the first certificate (see Figures 3 and 8, where the client 300 
corresponds to the client of the present claim, the server 310 corresponds to the third 
party of the present claim, and private key system 330 corresponds to the authorizer of 
the present claim; see also column 11, line 37-column 12, line 11). 

In reference to Claims 2 and 3, McGarvey further discloses providing a short- 
term use certificate to the third party (column 12, lines 30-35; column 8, lines 8-13). 
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In reference to Claim 4, McGarvey further discloses authenticating the authorizer 
upon accessing the URI (column 11, lines 60-61). 

In reference to Claims 5 and 6, McGarvey further discloses limiting and tracking 
the third party's use of the first certificate (column 8, lines 8-13). 

In reference to Claim 7, McGarvey further discloses that the contents of the first 
certificate are not revealed to the third party (see column 1 1 , lines 42-46). 

In reference to Claim 8, McGarvey further discloses that the first certificate can 
be revoked (see column 12, lines 30-36). 

In reference to Claim 9, McGarvey discloses a computer-implemented method 
including a client receiving a first certificate from an authorize, the client generating a 
URI associated with the first certificate and a third party, the client providing a second 
certificate and the URI to the third party (see column 12, lines 22-26), and the client 
providing the first certificate to the authorizer upon the authorizer accessing the URI 
after the third party has provided the second certificate and URI to the authorizer (see 
Figures 3 and 8, where the client 300 corresponds to the client of the present claim, the 
server 31 0 corresponds to the third party of the present claim, and private key system 
330 corresponds to the authorizer of the present claim; see also column 1 1 , line 37- 
column 12, line 11). 

In reference to Claim 12, McGarvey further discloses that the third party is 
granted access to the authorizer (column 8, lines 4-19). 
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In reference to Claim 13, McGarvey further discloses tracking a use of the 
second certificate (column 8, lines 8-13). 

In reference to Claim 14, McGarvey further discloses that the second certificate 
can be revoked (column 8, lines 10-13; column 12, lines 30-36). 

In reference to Claims 15 and 16, McGarvey discloses generating a second 
digital certificate issued from a client to a third party (see Figures 3 and 8, where the 
client 300 corresponds to the client of the present claim, the server 310 corresponds to 
the third party of the present claim, and private key system 330 corresponds to the 
authorizer of the present claim; see also column 1 1 , line 37-column 12, line 1 1 ) and a 
URI capable of retrieving a first digital certificate from a database associated with the 
client (see column 12, lines 22-26). 

Claim Rejections - 35 USC § 103 

16. The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all 
obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set 
forth in section 1 02 of this title, if the differences between the subject matter sought to be patented and 
the prior art are such that the subject matter as a whole would have been obvious at the time the 
invention was made to a person having ordinary skill in the art to which said subject matter pertains. 
Patentability shall not be negatived by the manner in which the invention was made. 

1 7. Claim 1 0 is rejected under 35 U.S.C. 1 03(a) as being unpatentable over 
McGarvey in view of Eastlake et al, "XML-Signature Syntax and Processing". 
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McGarvey discloses everything as applied above to Claim 9. However, 
McGarvey does not explicitly disclose the use of XML signatures. Eastlake discloses 
that XML signatures can be used to apply digital signatures to the content of resources 
that may be external to the signature itself (page 4, section 1.0, "Introduction"). 
Therefore, it would have been obvious to one of ordinary skill in the art at the time the 
invention was made to modify the system of McGarvey to include the use of XML 
signatures, in order to provide integrity and message or signer authentication (see 
Eastlake, page 1 , Abstract). 

18. Claims 1 1 and 17 are rejected under 35 U.S.C. 103(a) as being unpatentable 
over McGarvey in view of Ellison et al, "SPKI Certificate Theory". 

In reference to Claim 1 1 , McGarvey discloses everything as applied above to 
Claim 9. In reference to Claim 17, McGarvey discloses everything as applied above to 
Claim 15. However, McGarvey does not explicitly disclose the use of SPKI certificates. 
Ellison et al disclose that authorization certificates can be used to delegate 
authorizations (page 14, section 4, "Delegation") and that SPKI certificates can be used 
to define an authorization certificate (page 13, section 3.3, "SPKI Certificates"). 
Therefore, it would have been obvious to one of ordinary skill in the art at the time the 
invention was made to modify the systems and methods of McGarvey to include the use 
of SPKI certificates, in order to allow for authorizations to be delegated without needing 
to involve the owner of the resource concerned (see Ellison, page 14, section 4). 
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Conclusion 

1 9. Applicant's amendment necessitated the new ground(s) of rejection presented in 
this Office action. Accordingly, THIS ACTION IS MADE FINAL. See MPEP 
§ 706.07(a). Applicant is reminded of the extension of time policy as set forth in 37 
CFR 1.136(a). 

A shortened statutory period for reply to this final action is set to expire THREE 
MONTHS from the mailing date of this action. In the event a first reply is filed within 
TWO MONTHS of the mailing date of this final action and the advisory action is not 
mailed until after the end of the THREE-MONTH shortened statutory period, then the 
shortened statutory period will expire on the date the advisory action is mailed, and any 
extension fee pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of 
the advisory action. In no event, however, will the statutory period for reply expire later 
than SIX MONTHS from the date of this final action. 

Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to Zachary A. Davis whose telephone number is (571 ) 272- 
3870. The examiner can normally be reached on weekdays 8:30-6:00, alternate 
Fridays off. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Emmanuel Moise can be reached on (571) 272-3865. The fax phone 
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number for the organization where this application or proceeding is assigned is 571- 
273-8300. 

Information regarding the status of an application may be obtained from the 
Patent Application Information Retrieval (PAIR) system. Status information for 
published applications may be obtained from either Private PAIR or Public PAIR. 
Status information for unpublished applications is available through Private PAIR only. 
For more information about the PAIR system, see http://pair-direct.uspto.gov. Should 
you have questions on access to the Private PAIR system, contact the Electronic 
Business Center (EBC) at 866-217-9197 (toll-free). 
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